Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update module golang.org/x/net to v0.23.0 [SECURITY] #193

Merged
merged 1 commit into from
Apr 19, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Apr 19, 2024

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
golang.org/x/net v0.22.0 -> v0.23.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-45288

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

Copy link

codecov bot commented Apr 19, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 0.00%. Comparing base (f364322) to head (046ea23).

Additional details and impacted files
@@          Coverage Diff           @@
##           master    #193   +/-   ##
======================================
  Coverage    0.00%   0.00%           
======================================
  Files          27      27           
  Lines        1761    1761           
======================================
  Misses       1761    1761           
Flag Coverage Δ
go 0.00% <ø> (ø)
wasm 0.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@renovate renovate bot merged commit 1b47d83 into master Apr 19, 2024
13 checks passed
@renovate renovate bot deleted the renovate/go-golang.org/x/net-vulnerability branch April 19, 2024 20:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

0 participants